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Amendments to the Claims: 

This listing of claims will replace all prior versions, and listings, of claims in the 
application: 

Listing of Claims: 

1 . (Currently Amended) A telecommunications system arranged for 
providing Single Sign-On (SSO) services for a user roaming with a user equipment (UE) 
in a packet radio network of a Multinational Mobile Network Operator (MN-MNO) that 
includes a federation of National Network Operators (NNO), one of these National 
Network Operators holding the user's subscription, the telecommunications system 
comprising: 

a visited Gateway GPRS Support Node (V-GGSN) assigned for the user at a 
visited packet radio networi^ wherein the user is roaming, the V-GGSN sending user's 
identifiers relevant for the user's authentication toward the user's home network; and 

a home Authentication, Authorization and Accounting (H-AAA) server in the 
user's home service network, responsible for maintaining a master session for the user 
with said user's identifiers; 

a visited Authentication. Authorization and Accounting (V-AAA) server (4^ in the 
visited networit. acting as a proxy between the V-GGSN and the H-AAA, and binding an 
H-AAA address with said user's identifiers; and 

a global Single Sign-On Front End (G-SSO-FE) utilized as a single entry point for 
Single Sign-On service In the Multinational Mobile Networi< Operator federationJI,]] 
each s e rvioo prov i der i n th e f e d e rat i on provid i ng a specific Uniform R e sourc e Id e ntifi e r 
(URI) a s a phys i cal SSO e ntry po i nt tow a rds th e f e d e ration : and 

a number of Service Providers that have signed service aoreements with the 
Multinational Mobile Network Operator federation for offerina Sinale Sign-On services to 
users that are subscribers of any National Network Operator Included in the federation, 
each Service Provider In the federation providing a specific Uniform Resource Identifier 
(URI). as phvsical SSO entrv point towards the federation, and each Service Provider 
comprising: 
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redirection means for redirecting the user to the global Single Sian-On 
Front End (G-SSO-FE^ as entry point in the federation: 

receivino means for receiving a token from the user along with an 
indication of where the token was generated: 

retrieval means for retrieving an authentication assertion from a site where 
the token was generated: and 

checking means for checking that such site is trusted. 

2. (Previously Presented) The telecommunications system of claim 1 , 
further comprising a Global Directory of the Multinational Mobile Network Operator 
federation cooperating with the visited Authentication, Authorization and Accounting 
server in the visited network wherein the user is roaming to locate the home 
Authentication, Authorization and Accounting server in the user's home service network. 

3. (Previously Presented) The telecommunications system of claim 2, 
wherein the Global Directory is an entity arranged for storing an association between 
user's identifiers relevant for user's authentication and an address of a corresponding 
home Authentication, Authorization and Accounting server. 

4. (Previously Presented) The telecommunications system of claim 1 , 
wherein the visited Authentication, Authorization and Accounting server in the visited 
network wherein the user is roaming, keeps a binding of a home Authentication, 
Authorization and Accounting server address and user's identifiers within a Local 
Dynamic Routing Database. 

5. (Previously Presented) The telecommunications system of claim 4, 
wherein said user's identifiers comprise a user directory number and an IP address 
assigned to the user. 
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6. (Previously Presented) The telecommunications system of claim 1 , 
wherein the home Authentication, Authorization and Accounting server in the user's 
home service network maintains a master session for the user in cooperation with a 
Single Sign-On Session Database (SSO Session DB) for storing session related 
information comprising a user directory number, an IP address assigned to the user, an 
indicator of a selected authentication mechanism, and a timestamp. 

7. (Currently Amended) The telecommunications system of claim 1 , 
wherein the token is either an authentication assertion or a reference thereof, fafther 
comprising a numbor of Sorvioo Prov i ders that havo signod sorv i co agroements with th e 
Mu l t i nationa l Mob ile N e twork Op e rator f e d e r a tion for offering S i ngle Sign - On s e rv i c e s to 
uoors that aro oubsoriborc of any Nat i onal Network Operator i nc l udod in the fodoration, 
each Sorvico Prov i dor comprie i ng: 

rod i rootion moans for redirooting a user to the global Single S i gn On Front End 
(G SSO FE) 00 ontry po i nt in tho fodoration; 

roGo i ving m e ans for r e ceiving a tok e n from th e us e r, th e tok e n being ei th e r an 
authontication assort i on. or a reforonco thoroof along with an indication of whoro ouch 
aosortion was gonoratod; 

r e tri e va l m ea ns for r e tri e v i ng an a ssertion from a sit e wh e r e th e a s s e rtion was 
gonoratod ; and 

chocking moano for chocking that such cito is trustod. 

8. (Cun^ently Amended) The telecommunications system of claim 1 
[[7]], wherein each particular Service Provider may have a different global Single Sign- 
On Front End for acting as entry point in the federation. 

9. (Previously Presented) The telecommunications system of claim 8, 
wherein each particular Service Provider further comprises means for changing from 
one global Single Sign-On Front End to another within the federation for acting as entry 
point in said federation. 
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10. (Currently Amended) A method for providing Single Sign-On 
services through a number of Service Providers having service agreements with a 
Multinational Mobile Network Operator (MN-MNO) for a user roaming with a user 
equipment (UE) in a packet radio network of said Multinational Mobile Network Operator 
that includes a federation of National Network Operators, one of these National Network 
Operators being a home service network for the user and holding the user's 
subscription, the method comprising the steps of: 

(a) authenticating the user roaming in a visited packet radio network, via a proxy, 
toward the user's home service network; -af\4 

(b) creating a master session at the user's home service network with Single 
Sign-On related data; 

(c) redirecting the user accessing a Service Provider, that has a service 
agreement with the Multinational Mobile Network Operator, toward the user's home 
network via a global Single Sign-On Front End (G-SSO-FE) entry point in the federation 
for obtaining a Single Sign-On authentication assertion, each service provider in the 
federation providing a specific Uniform Resource Identifier as a Single Sign-On service; 
and 

(d) receiving a Single Sign-On authentication assertion eithef-from the user or 
from an entity where such assertion was generated, along with an address of such 
entity: and 

(e) validating the Single Sian-On authentication assertion with the entitv having 
generated the assertion. 

1 1 . (Previously Presented) The method of claim 10, wherein the step b) of 
creating a master session at the user's home service network with Single Sign-On 
related data further comprises the steps of: 

storing at a Single Sign-On Session Database Single Sign-On related data 
comprising a session identifier, a session status, a user directory number, an IP address 
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assigned to the user, an indicator of a selected authentication mechanism, and a 
timestamp of the authentication event; and 

binding at a user's visited service network an address of an entity handling the 
master session for such user at the user's home service networl<, and a set of user's 
identifiers that includes at least a user directory number, and an IP address assigned to 
the user. 

1 2. (Previously Presented) The method of claim 1 0, wherein the step a) of 
performing a first authentication of a user roaming in a visited packet radio network 
includes a step of assigning a visited Gateway GPRS Support Node for the user at the 
visited packet radio network. 

1 3. (Previously Presented) The method of claim 1 2, wherein the step of 
assigning a visited Gateway GPRS Support Node includes a step of sending user's 
identifiers relevant for a first user's authentication from said visited Gateway GPRS 
Support Node toward a home Authentication, Authorization and Accounting server in 
the user's home service network for maintaining a user's master session. 

14. (Previously Presented) The method of claim 1 3, wherein the step of 
sending user's identifiers includes a step of interposing a visited Authentication, 
Authorization and Accounting server in the visited network, acting as a proxy between 
said visited Gateway GPRS Support Node and the home Authentication, Authorization 
and Accounting server in user's home network. 

1 5. (Previously Presented) The method of claim 1 0, wherein the step c) of 
redirecting a user toward the user's home network via a global Single Sign-On Front 
End (G-SSO-FE) comprises the steps of: 

c1 ) determining a visited network which assigned the current IP address to the 
user when accessing the federation networi<; and 
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c2) obtaining fronn the visited networic an address of an entity handling a user's 
master session in the user's home service networl^. 

1 6. (Previously Presented) The method of claim 1 5, wherein the step c2) 
of obtaining an address of an entity handling the master session for such user includes 
a step of redirecting the user toward the cunrently visited networlt. 

1 7. (Previously Presented) The method of claim 1 5, wherein the step c2) 
of obtaining an address of an entity handling the master session for such user includes 
a step of requesting such address from the global Single Sign-On Front End toward the 
visited network by using a Back-End protocol. 

18. (Previously Presented) The method of claim 1 5, wherein the step c1 ) 
of determining the visited network includes a step of querying a Global Directory about 
the National Network Operator in charge of assigning a given user's IP address. 

19. (Currently Amended) The method of claim 1 0, wherein the step d) of 
receiving a Single Sign-On authentication assertion from the entity where such 
assertion was generated includes a step of: tho stops of : 

receiving from the user a reference to said assertion along with an address of 
such entity^ 
^an4 

va li dat i ng tho assortion with th e e nt i ty having g e n e rat e d the assertion. 
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